CVE-2024-25635

Summary

CVE-2024-25635 is a vulnerability affecting the alf.io ticket reservation system prior to version 2.0-Mr-2402. This issue allows organization owners to view the API keys and user details of other organization owners using the `http://192.168.26.128:8080/admin/api/users/<user_id>` endpoint. The user ID provided in the endpoint may also reveal the API key embedded in that user's username. This vulnerability poses a significant risk as it exposes sensitive information and can lead to unauthorized access. The issue has been resolved in version 2.0-M4-2402.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.